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The  botulinum  neurotoxins  (BoNTs)  act  with  high  specificity  and  high  potency  to  prevent  neurotransmitter  release  at  the  neuromuscular 
junction,  causing  sustained  paralysis,  and  at  sufficiently  high  doses  death  by  asphyxiation.  The  seven  BoNT  serotypes  are  the  most  potent 
substance  known  to  man  and  are  the  only  toxins  designated  Tier  1  select  agents.  Modeling  of  toxin  distribution,  mortality  rates  and  first 
response  limitations  suggests  that  deployment  of  small  amounts  by  terrorists  could  rapidly  incapacitate  the  critical  care  infrastructure. 

Since  BoNT  is  both  a  unique  and  valuable  therapeutic  drug  as  well  as  a  highly  potent  weapon,  the  toxin  is  currently  the  only  true  “dual-use” 
select  agent.  The  same  characteristics  that  render  the  toxin  a  dangerous  chemical  weapon  (persistence  in  vivo,  exceedingly  high  potency, 
ease  of  distribution  and  ease  of  production)  also  make  it  highly  effective  for  a  broad  range  of  clinical  applications.  The  expansion  in 
therapeutic  BoNT  uses  is  contributing  to  the  increasing  number  of  black  market  BoNT  producers,  which  in  turn  raises  the  risk  that 
technologies  for  synthesis,  purification  and  distribution  could  be  utilized  to  support  political  or  economic  terrorism.  Below,  we  present  a 
short  review  of  the  disruptive  potential  of  the  BONTs,  emphasizing  the  nature  of  the  security  risk. 
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"Paralyzed  force,  gesture  without  motion  ” 

-The  Hollow  Men  (1925),  Thomas  Stearns  Eliot 

1.  Introduction.  The  flaccid  paralysis  caused  by  ingestion  of  botulinum  neurotoxin  (BoNT)  was 
first  described  as  “sausage  poisoning”  in  1820  and  attributed  to  a  bacterium  in  1897  [1].  We 
now  know  that  the  toxin  is  a  protein  produced  by  Clostridium  botulinum  and  currently  comes  in 
seven  different  serotypes  designated  /A  to  /G  (e.g.,  BoNT/A  represents  the  toxin  produced  by  C. 
botulinum  serotype  A).  Although  the  serotypes  exhibit  different  host  ranges  and  cellular  targets, 
intoxication  of  susceptible  hosts  invariably  results  in  neuromuscular  paralysis. 

The  same  characteristics  that  make  the  BoNTs  the  most  lethal  substances  known  (persistence 
in  vivo,  exceedingly  high  potency,  ease  of  use  and  ease  of  production)  also  renders  the  toxin  an 
effective  pharmaceutical  for  a  broad  range  of  therapeutic  and  cosmetic  uses  [2-3].  BOTOX® 
(the  brand  name  for  the  most  common  BoNT  preparation)  and  its  competitors  are  projected  to 
net  $1.5  to  $2  billion  in  201 1  sales  of  cosmetic  and  therapeutic  products  [4].  The  rapidly 
increasing  list  of  off-label  therapeutic  uses  for  the  toxin  is  contributing  to  the  expanding  number 
of  black  market  BoNT  producers,  which  in  turn  raises  the  risk  that  technologies  for  synthesis, 
purification  and  distribution  could  be  utilized  to  support  political  or  economic  terrorism  [5]. 
Although  the  total  amount  of  toxin  in  a  clinical  preparation  for  cosmetic  use  is  less  than  1%  of 
the  dose  necessary  to  kill  a  single  person,  production  processes  are  effectively  the  same  for  bulk 
toxin  and  clinical  grade  toxin.  In  2010,  the  Washington  Post  reported  that  an  unlicensed 
purveyor  of  concentrated  toxin  was  identified  in  Russia  [6].  Although  the  man  escaped  and  the 
(alleged)  Chechnyan  producer  of  that  particular  lot  of  toxin  was  apparently  not  located,  the  Post 
reported  that  US  officials  believed  that  “dozens  of  labs”  located  in  Europe  and  Asia  are 
supplying  an  expanding  black  market  for  BoNT  (these  estimates  are  consistent  with  a  2010 
report  commissioned  by  the  DOD  Defense  Threat  Reduction  Agency  [7]).  As  the  article  notes, 
“[BoNT]  is  the  only  profit-making  venture  for  terrorists  that  can  also  potentially  yield  a  weapon 
of  mass  destruction.”  Since  BoNT  is  both  a  unique  and  valuable  therapeutic  drug  as  well  as  a 
highly  potent  weapon,  the  toxin  is  currently  the  only  true  “dual-use”  select  agent.  The  purpose 
of  this  report  is  to  provide  context  as  to  the  dangers  presented  by  malicious  use  of  BoNT. 

2.  BoNT  Structure  and  Cellular  Mechanism  of  Action.  The  BoNTs  are  relatively  large 
heterodimeric  proteins,  comprised  of  a  50  kiloDalton  (kDa)  light  chain  (LC)  and  a  100  kDa 
heavy  chain  (HC).  The  LC  is  responsible  for  intracellular  enzymatic  activity,  and  the  HC 
provides  neuron-specific  targeting  and  acts  as  a  vehicle  to  transport  the  LC  into  the  presynaptic 
compartment.  Since  BoNTs  cannot  penetrate  the  skin,  the  toxin  must  be  internalized  by 
ingestion,  inhalation  or  injection  to  be  dangerous.  There  are  several  “natural”  ways  to  contract 
botulinum  poisoning: 

•  Ingestion  of  prefonned  toxin,  for  example,  by  ingestion  of  foods  in  which  spores  have 
germinated  under  anaerobic  conditions  (typically  home-canned;  fennented,  uncooked;  or 
improperly  cooked  dishes); 
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•  Ingestion  of  spores,  which  in  turn  colonize  the  small  intestine  (occurs  in  infants  or 
clinical  patients  taking  antibiotics  that  depopulate  the  gut  flora);  and 

•  Contamination  of  a  wound  by  the  bacterium,  which  then  secretes  toxin  into  the 
bloodstream. 

After  exposure  by  any  of  the  above  routes,  BoNT  gains  access  to  the  bloodstream  and  binds 
to  neuron-specific  receptors  present  on  presynaptic  terminals  of  neuromuscular  junctions  (NMJ). 
NMJs  are  cellular  structures  at  which  a  nerve  tenninal  synapses  with  a  muscle  fiber.  Activation 
of  the  nerve  terminal  results  in  the  release  of  chemical  messengers  that  instruct  the  muscle  fiber 
to  contract.  By  binding  to  presynaptic  receptors,  BoNTs  employ  a  Trojan  horse-like  strategy  to 
gain  access  to  the  interior  of  the  nerve  terminal,  whereupon  the  toxin  targets  one  of  three  proteins 
for  destruction.  These  proteins— SNAP-25,  VAMP-2  and  syntaxin— are  essential  to  the  release  of 
neurotransmitter  from  the  neuron  [8-9].  Functionally,  this  means  that  neurons  can  no  longer 
elicit  muscle  contraction,  resulting  in  muscular  paralysis.  Once  the  nerves  that  control  the 
diaphragm  are  intoxicated,  emergent  respiratory  failure  ensues  and  victims  asphyxiate  [9]. 

3.  Medical  Approaches  to  Protect  from  Intoxication.  Counteragents  to  BoNT  can  either  be 
delivered  prophylactically  (prior  to  the  onset  of  symptoms)  or  therapeutically  (after  the  onset  of 
symptoms).  Prophylactic  resistance  to  several  hundred  LD50s  of  toxin  can  be  induced  by  a  series 
of  immunizations  using  inactivated  toxin  as  an  immunogen.  Immunized  persons  can  no  longer 
be  treated  with  BoNT  for  therapeutic  or  cosmetic  purposes,  so  this  approach  is  not  widespread. 
Alternatively,  short-term  prophylactic  protection  can  be  provided  by  delivery  of  immunoglobulins 
harvested  from  previously  immunized  farm  animals,  which  can  scavenge  BoNT  while  it  is  still  in 
the  vascular  system.  In  animal  studies,  delivery  of  this  “antitoxin”  within  12  hours  of  challenge 
with  over  1,000  lethal  doses  of  BoNT  has  protected  against  paralysis.  However,  since  the 
antitoxin  is  rapidly  cleared  from  the  body  and  is  not  effective  against  BoNT  that  has  already 
bound  to  or  been  internalized  into  neurons,  it  only  provides  prophylactic  protection.  Due  to  the 
limited  availability  of  the  antitoxin,  adverse  events  resulting  from  cross-species  reactions  and 
short-lived  protection  of  antitoxin  preparations,  widespread  antitoxin  prophylaxis  is  impractical. 

Once  the  toxin  is  sequestered  within  the  presynaptic  terminus,  no  therapeutic  approaches  are 
currently  available  to  accelerate  the  recovery  from  paralysis.  Identifying  such  therapeutic 
candidates  is  the  purpose  of  our  research  program  [10].  It  is  estimated  that  as  few  as  10-100 
toxin  molecules  per  synapse  are  sufficient  to  cause  paralysis,  which  means  that  a  therapeutic 
must  be  exquisitely  potent  and  highly  efficient  to  result  in  clinically  effective  inhibition  of  LC 
activity. 

Clinical  Presentation  and  Treatment  of  BoNT  Intoxication.  The  first  clinical  evidence  of 
botulinum  intoxication  generally  appears  within  1-2  days  after  exposure  as  an  acute,  symmetric, 
descending,  flaccid  paralysis  with  a  normal  sensorium.  These  symptoms  are  the  result  of  toxin 
that  has  already  been  internalized  into  neurons  and  therefore  cannot  be  reversed.  Once  evidence 
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of  intoxication  is  present,  clinical  options  are  limited  to  supportive  care  and  to  inactivating 
residual  toxin  that  may  remain  within  the  blood  [11].  Victims  receiving  a  lethal  dose  (described 
below)  require  ICU  support,  including  a  ventilator  for  respiratory  support  and  a  feeding  tube  for 
parenteral  nutrition.  Despite  being  paralyzed,  patients  do  not  suffer  cognitive  deficits  and  remain 
conscious,  though  unable  to  effectively  communicate.  Substantial  resources  are  required  to 
provide  the  full-time  support  necessary  to  care  for  these  patients,  and  as  few  as  a  dozen 
paralyzed  victims  are  likely  to  saturate  the  capacity  of  a  mid-size  city  hospital  ICU.  Depending 
on  the  serotype,  paralysis  can  persist  for  months,  requiring  sustained  intensive  medical  care  [12-13]. 
Furthermore,  once  the  toxin  is  cleared  from  poisoned  nerve  termini,  the  synapse  must  be 
regenerated  and  coordinated  neuromuscular  control  re-established.  In  a  recent  instance  of  BoNT 
exposure  resulting  from  physician  error,  the  patient  required  nearly  a  year  to  become  ambulatory 
[14].  Even  5  years  after  the  exposure,  the  victim  still  exhibits  what  appear  to  be  residual 
morbidities,  including  muscle  weakness,  emotional  distress  and  frequent  headaches  (personal 
communic  ation) . 

4.  Crisis  Management  and  Deployment  of  BoNT  as  a  Terror  Weapon.  Misuse  of  BoNT, 
either  deliberate  or  accidental,  is  likely  to  result  in  a  large  number  of  patients  simultaneously 
presenting  with  the  early  symptoms  of  intoxication.  Since  the  first  symptoms  of  intoxication 
manifest  within  12-48  hours  as  a  progressive  paralysis  which  can  easily  be  confused  with  a 
diversity  of  other  illnesses,  there  is  a  high  likelihood  that  early  victims  will  suffer  significant 
paralysis  prior  to  clinical  diagnosis.  Since  the  antitoxin  is  most  effective  within  12  hours  of 
exposure,  timing  is  crucial  in  terms  of  reducing  the  extent  of  paralysis  in  the  exposed  population. 
Furthermore,  due  to  the  high  potential  of  adverse  events  following  immunization  with  a  cross¬ 
species  immunoglobin  preparation,  clinicians  may  be  initially  hesitant  to  apply  antitoxin  without 
strong  epidemiological  or  clinical  evidence  of  exposure.  Limiting  the  number  and  severity  of 
clinically  intoxicated  victims  will,  therefore,  depend  on  how  quickly  medical  personnel  can  work 
through  the  differential  diagnoses,  request  and  obtain  antitoxin,  identify  the  potentially  exposed 
population  and  deliver  the  antitoxin,  while  simultaneously  managing  victims. 

Consequently,  effective  casualty  management  procedures  depend  on  the  early  identification 
and  treatment  of  potential  casualties  while  simultaneously  providing  emergency  care  to  extant 
victims.  The  ability  of  caretakers  to  ensure  that  the  exposed  population  is  alerted  and  provided 
with  a  post-exposure  prophylaxis  are  limited  by  at  least  two  key  delays:  the  period  of  time  before 
a  differential  diagnosis  is  correctly  made  and  the  delay  between  diagnosis  and  the  notification 
and  monitoring  of  the  exposed  population.  These  problems  become  more  complicated  once  the 
general  population  becomes  aware  of  the  emergency,  and  healthcare  facilities  are  flooded  by 
healthy  persons  seeking  prophylaxis,  despite  being  clinically  asymptomatic. 

Due  to  the  high  medical  resource  demands  of  paralyzed  victims,  emergency  care  providers 
and  clinical  ICUs  will  find  it  difficult  to  provide  beds,  ventilators,  personnel  and  ancillary  critical 
care  needs  without  sacrificing  other  clinical  services  for  the  duration  of  the  victim’s  residency. 

In  such  a  scenario,  those  victims  that  become  symptomatic  the  earliest  are  likely  to  suffer  the 
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most  severe  paralysis.  The  resource  bottleneck  of  any  disaster  response  will  be  the  availability 
of  emergency  personnel,  ventilators  and  critical  care  beds,  which  can  easily  become 
overwhelmed.  Thus,  even  a  small-scale  mass  casualty  event  could  rapidly  disrupt  the  local 
health-care  infrastructure.  For  anybody  trained  in  epidemiology  and  crisis  management,  this 
presents  a  “devil’s  brew”  of  potential  failure  points  and  emphasizes  the  critical  need  for  a 
therapeutic  that  offers  symptomatic  relief  from  BoNT-mediated  paralysis. 

A.  How  Severe  a  Threat  Does  BoNT  Really  Represent?  It  is  a  truism  among  the 
biodefense  community  that  BoNT  is  the  most  toxic  substance  known.  The  dose  of  BoNT/A  that 
will  kill  50%  of  an  exposed  population  is  estimated  from  animal  studies  to  be  as  low  as  0.4  ng/kg 
body  weight  by  intravenous  administration,  3  ng/kg  by  inhalation  and  50  ng/kg  by  ingestion. 

This  means  that  for  a  70-kg  (155  lb)  human,  inhaling  as  little  as  0.0002  mg  (or  0.000000007  oz) 
of  toxin  is  likely  to  result  in  mortality.  BoNT/B  and  /E  have  similar  potencies.  The  BoNTs  are 
10  to  10  times  more  lethal  than  other  chemical  warfare  agents  (such  as  ricin,  sulfur  mustard  or 
nerve  agents),  resulting  in  their  classification  by  the  CDC  as  one  of  six  Category  A  select  agents, 
and  the  only  Category  A  agent  that  is  a  toxin.  The  Category  A  agents  have  the  highest  priority 
for  research  and  defense  based  on  ease  of  dissemination,  high  mortality  rates,  the  potential  for 
major  public  health  impact,  the  ability  to  cause  public  panic  and  social  disruption,  and  the 
requirement  for  special  action  for  public  health  preparedness  [15]. 

B.  Mathematical  Models  of  a  BoNT  Deployment.  Although  malicious  delivery  of 
preformed  toxin  is  possible  by  injection  or  aerosol  inhalation,  dispersal  in  food  or  liquid  matrix 
may  be  a  more  plausible  route  for  a  mass  casualty  event.  Hypothetical  models  describing  the 
distribution  of  BoNTs  in  a  liquid  dispersal  medium  have  been  developed  from  real-life  incidents 
of  biotoxin  exposure  [16-17].  A  more  detailed  mathematical  exercise  that  highlights  how  toxin 
could  be  used  in  a  terrorism  event  was  presented  by  Stanford  University  Professor  Lawrence 
Wein  in  a  PNAS  paper  and  a  2005  New  York  Times  guest  editorial  [18-19].  Dr.  Wein  described 
procedures  by  which  addition  of  gram-quantities  of  toxin  to  unpasteurized  milk  prior  to  delivery 
to  a  raw-milk  silo  could  result  in  the  exposure  of  10-100  times  more  civilians  than  died  in  the 
terrorist  attacks  on  September  11,  2001. 

Some  back-of-the-envelope  calculations  substantiate  how  the  carefully  planned  delivery  of  a 
small  amount  of  neurotoxin  could  rapidly  overwhelm  a  municipality’s  emergency  management 
system.  For  example,  drinking  8  ounces  of  liquid  tainted  with  3.5  ug  of  BoNT/A  would 
constitute  a  median  human  lethal  dose.  Addition  of  as  little  as  14  ug  of  toxin  to  a  quart  of  liquid 
would  be  sufficient  to  achieve  this  concentration.  Thus,  delivery  of  one  gram  of  toxin 
(equivalent  to  the  weight  of  a  paperclip,  and  relatively  easy  to  generate  from  a  toxic  strain  of  C. 
botulinum  with  minimal  training  [6])  to  a  bulk  liquid  prior  to  distribution  would  be  sufficient  to 
contaminate  approximately  69,000  quart  containers.  If  we  assume  that  the  toxin  is  stable  in  the 
dispersal  medium,  then  50%  of  those  that  drink  at  least  8  oz  would  die  within  2-3  days  without 
medical  support,  and  nearly  all  would  require  acute  and  prolonged  medical  care.  Even  if  this 
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were  only  a  regionally  distributed  item,  one  can  imagine  the  widespread  alarm  and  chaos  once  it 
became  apparent  that  a  commercial  product  had  been  tainted  with  a  slow-acting,  lethal  toxin. 


As  noted  in  a  rebuttal  to  Dr.  Wein’s  paper,  these  scenarios  include  a  number  of  simplifying 
assumptions,  including  the  belief  that  unconventional  actors  would  have  the  expertise  to  generate 
gram  quantities  of  toxin  [20],  However,  given  evidence  of  an  increase  in  illicit  producers  of 
black  market  BoNT,  the  acquisition  of  knowledge  and  skills  necessary  for  bulk  production 
clearly  does  not  present  an  insurmountable  barrier,  particularly  to  a  state-supported  organization 
[5].  In  fact,  a  study  by  two  biodefense  researchers  asserts  that  a  trained  laboratory  technician  can 
produce  a  gram  of  purified  toxin  for  as  little  as  $2,000.’  Instructions  on  growing  toxic  strains 
and  purifying  toxin  using  household  items  are  available  from  multiple  places  online.”  Unlike 
infectious  agents  or  chemical  agents  that  have  percutaneous  activity,  C.  botulinum  and  purified 
toxin  can  be  safely  handled  with  relatively  few  precautions.  A  more  sophisticated  approach 
would  obviate  the  need  to  culture  a  toxic  strain  by  synthesizing  a  BoNT  gene  sequence  from 
publicly  available  databases  and  expressing  the  recombinant  gene  in  E.  coli  using  commercially 
available  bacterial  expression  vectors  (a  routine  laboratory  procedure).  This  would  also  enable 
the  facile  modification  of  the  recombinant  gene,  for  example  to  modify  potency  or  escape 
biosurveillance.  Although  production  of  toxin  with  sufficient  potency  to  enable  a  mass  exposure 
is  theoretically  feasible  with  minimal  training,  we  would  argue  that  a  far  more  significant  threat 
is  presented  by  malefactors  with  post-graduate  training  in  the  life  sciences  who  have  access  to  an 
equipped  and  functioning  research  facility. 

If  nothing  else,  Dr.  Wein’s  paper  described  for  the  first  time  a  critical  security  gap  (which  has 
since  been  mitigated)  and  invoked  an  extensive,  ongoing  debate  in  the  biodefense  community 
over  what  type  of  information  should  be  presented  in  open  scientific  literature  [21].  It  should 
also  be  noted  that  some  food  products  may  be  more  amenable  to  contamination  with  active  BoNT 
than  milk-based  dairy  products,  although  for  obvious  reasons  these  will  not  be  discussed  here. 

6.  Conclusions.  The  botulinum  neurotoxins  act  with  high  specificity  and  high  potency  to 
prevent  neurotransmitter  release  at  the  neuromuscular  junction,  causing  sustained  paralysis,  and 
at  sufficiently  high  doses,  death  by  asphyxiation.  The  same  characteristics  that  make  the  BoNTs 
such  effective  therapeutic  tools  also  put  them  at  high  risk  of  misuse  and  have  resulted  in  their 
classification  as  CDC  Category  A  select  agents.  Mathematical  modeling  of  toxin  distribution 
and  mortality  rates  suggests  that  deployment  of  as  little  as  one  gram  by  terrorists  could  result  in 
1 04- 1 0^  casualties.  It  is  worth  acknowledging  that  the  modernization  of  epidemiological 
surveillance  networks  and  emergency  management  plans  since  the  American  anthrax  attacks  of 
2001  is  likely  to  mitigate  morbidity  and  mortality.  Moreover,  distributing  sufficient  toxin  via 


1  information  held  by  author. 

2  information  held  by  author. 

3  information  held  by  author. 
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contamination  of  commercial  products,  although  feasible,  would  be  a  difficult  undertaking  and 
likely  to  be  prone  to  failure. 

A  criticism  of  the  argument  that  BoNT  presents  a  significant  bioterror  threat  revolves  around 
the  opinion  that  growing  potent  strains  of  C.  botulinum  and  purifying  sufficient  toxin  for  a  large- 
scale  attack  are  more  difficult  than  expected.  These  counterarguments  are  weakened  by  the 
transformative  potential  of  modern  molecular  biology,  the  widespread  availability  of  protocols, 
and  the  fact  that  a  successful  dissemination  to  even  a  small  area  would  be  highly  disruptive  to  the 
economy  and  the  medical  infrastructure.  In  fact,  contaminating  a  handful  of  products  at  several 
grocery  stores  by  direct  injection  of  toxin  may  have  a  disruptive  effect  while  requiring  small 
amounts  of  BoNT  (less  than  the  exempt  limit)  and  would  be  relatively  easy  to  execute  without 
suspicion. 

There  is  no  public  evidence  of  a  successful  bioterror  attack  against  US  citizens  by  a  foreign 
agency  following  9/11.  This  begs  the  question:  if,  as  asserted,  it  is  relatively  easy  to  generate  a 
Category  A  select  agent  such  as  BoNT  at  sufficient  levels  to  enable  its  use  as  a  terror  weapon, 
why  have  such  attacks  not  happened?  In  the  absence  of  additional  infonnation  we  can  only 
hypothesize.  Perhaps  it  is  merely  a  matter  of  time  until  such  an  attack  occurs;  perhaps  we  have 
an  active,  covert  program  that  has  successfully  prevented  such  attacks  from  happening;  perhaps 
those  that  provide  direction  to  malefactors  believe  that  a  biological  or  chemical  attack  will 
mandate  too  severe  of  a  response;  or  perhaps  other,  less  technically  intensive  approaches  are 
more  suited  to  the  current  technological  level  of  terrorist  activities.  Regardless,  although 
exercises  such  as  those  presented  by  Dr.  Wein  incite  controversy,  they  also  illustrate  that  a 
successful  exploitation  of  gaps  in  food  security  measures  could  have  a  crippling  effect  on  our 
healthcare  system,  and  would  be  likely  to  result  in  a  transformative  event  that  could  exceed  9/11 
in  scope. 
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